> Has anyone actually found a good use for filenames containing newlines?
Yes - in tests for code that handles filenames, shell or otherwise.
Yes - in tests for code that handles filenames, shell or otherwise.
This certainly clarifies that input validation & robustness is a security matter
Though I agree that's the standout quote from the list. I've used it before at work, as appropriate.
Honestly, though, it's one reason I write a lot of my own scripts in zsh these days. Zsh has its own quirks, and I don't touch oh-my-zsh with a barge pole, but it's a darn sight quicker to reason about expansions in zsh code compared to bash, especially if arrays are in the mix. Unfortunately zsh is not necessarily available everywhere and certainly remains outside the base install of many *nix distros.
[1] we can prove the existence of at least one such device, by construction: it's the CI/CD host on which tests run, because those tests themselves may specifically and intentionally be for safe handling of such filenames, and therefore rely on being able to instantiate them
That sounds like a variant of the old broken window fallacy.